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^^ Abstract 

(N 



V^ Non-additivity is one of the distinctive traits of Quantum Information Theory: the combined use of quan- 

tum objects may be more advantageous than the sum of their individual uses. Non-additivity effects have 
been proven, for example, for quantum channel capacities, entanglement distillation or state estimation. 
In this work, we consider whether non-additivity effects can be found in Classical Information Theory. 
We work in the secret-key agreement scenario in which two honest parties, having access to correlated 
classical data that are also correlated to an eavesdropper, aim at distilling a secret key. Exploiting the 
analogies between the entanglement and the secret-key agreement scenario, we provide some evidence 
that the secret-key rate may be a non-additive quantity. In particular, we show that correlations with 
flj conjectured bound information become secret-key distillable when combined. Our results constitute a 

5^ new instance of the subtle relation between the entanglement and secret-key agreement scenario. 

:3 

I Introduction 

'"H Classical communication systems are governed by classical information theory, a vast discipline whose 

>^ birth coincides with a seminal paper of Claude Shannon [I . Among his contributions, Shannon intro- 

duced the concept of channel capacity, which quantifies the maximum communication rate that can be 

^L achieved over a classical channel. One key feature of the channel capacity is its additivity: the total 

7—i capacity of several channels used in parallel is simply given by the sum of their individual capacities. 

_^ This fact implies thus that the channel capacity completely specifies channel's ability to convey classical 

f~^ information. 

O^l Moving to the quantum domain, the quantum channel capacity captures the ability of a quantum 

^~~^ channel to transmit quantum information. Smith and Yard [2 proved recently that the quantum capacity 

^ is not additive. In particular, they provide examples of two channels with zero quantum capacity that 

define a channel with strictly positive quantum capacity when combined. This intriguing quantum effect 

is known as activation and can generally be understood as follows: the combined use of quantum objects 

j^ can be more advantageous than the sum of their individual uses. In the last years, an intense effort 

has been devoted to the study of non-additivity effects in Quantum Information Theory. Classical and 

private communication capacity of quantum channels were later shown not to be additive in Refs [3l |4] . 

Nowadays, non-additivity is considered to be one of the distinctive traits of Quantum Information Theory. 

Before the results by Smith and Yard, however, non-additivity effects had also been observed in 

Entanglement Theory in the context of entanglement distillation. There, one is interested in the problem 

of whether pure-state entanglement -pure entanglement in what follows- can be extracted from a given 

state shared by several observers using local operations and classical communication (LOCC). In Ref. [S], 

the authors provide examples of multipartite states that (i) are non-distillable (bound) when considered 

separately but (ii) define a distillable state when taken together. Moving to the case of two parties, and 



* giuseppe.prettico@icfo.es 



leaving aside activation-like results as those of [5], it remains unproven whether entangled states can be 
activated. There is however some evidence of the existence of pairs of bound (non-distillable) entangled 
states that give a distillable state when combined [3 |8j . 

In this work we are interested in the question of whether non-additivity effects can be observed 
in Classical Information Theory. As mentioned, classical channel capacities are known to be additive. 
Therefore, we move our considerations to distillation scenarios. In particular, we focus on the classical 
secret-key agreement scenario in which two honest parties, having access to correlated random vari- 
ables, also correlated with an adversary, aim at establishing a secret key by local operations and public 
communication (LOPC). While the activation of classical resources has been shown in a multipartite 
key-agreement scenario in [21 [TD], here we consider the more natural case of two honest parties. In 
our study, we exploit the analogies between the secret-key agreement and entanglement scenario noted 
in [TT]. Based on the results of [S], we provide evidence that activation effects may be possible in the 
completely classical bipartite key-agrement scenario. Our findings, therefore, suggest that the classical 
secret-key rate is non-additive. 

This article is structured as follows: Section IT] contains a brief introduction to the entanglement and 
the secret-key agreement scenario. After pointing out the analogies between the two scenarios, our main 
results are derived in section [2J Section [3] concludes with a discussion of how our findings are related to 
other results and conjectures in the field. 

1 Entanglement vs secret correlations 

The aim of this section is to introduce the entanglement and secret-key agreement scenario. As first 
noted in [12], there are several analogies between these two scenarios despite the fact that they involve 
objects of different nature, namely entangled quantum states vs classical joint probability distributions. 
These analogies play a key role in the derivation of our results in the next section. 

1.1 Entanglement scenario 

A maximally entangled state of two qubits represents the most representative example of a bipartite 
entangled state and is an essential ingredient in many applications of quantum information theory |13j . 
It is defined as: 

l'/') = ;^(|00) + |ll))^5 (1) 

The relevance of this state for communication purposes is due essentially to two main facts: first, for 
each projective measurement by one of the observers, there exists another measurement by the other 
observer giving perfectly correlated results. Second, being a pure state, no third party can be correlated 
with it. State M represents the basic unit of entanglement and is also known as ebit, for entangled bit. 
This is because an asymptotically large number of copies of an arbitrary pure entangled state can be 
converted into another asymptotically large number of ebits in a reversible way [14j . 

In any realistic situation, quantum states are affected by noise. In the case of a composite system 
shared by two observers, Alice and Bob (also A and B), the ideal pure entangled states is mapped into 
a mixed state pab- Any noise can be modeled as interaction with an environment, E, as any state can 
be seen as the trace of a pure state on a sufficiently large environment. In the bipartite case considered 
here one has pab = i'i:E\4'ABE){''pABE\- Of course, the interaction with the environment deteriorates the 
entanglement present in the state. Thus, given a generic quantum state pab, or equivalently the whole 
tripartite state IV'abb), quantifying the entanglement between A and B is a fundamental question. 
Two quantifiers play a crucial role because of their operational meaning: the entanglement cost and 
the entanglement of distillation. Both quantities are defined in the asymptotic scenario consisting of 
an asymptotically large number of identical copies of the state. The entanglement cost [THj, denoted 
by Ec, quantifies the number of ebits per copy needed for the formation of the given quantum state 
by LOCC. The entanglement of distillation [T^, denoted by Ejj, indicates the amount of ebits per 
copy that can be obtained from it by LOCC. For a state pab, Ec{pab) > implies that the state is 
entangled, while Ed{pab) > indicates that some pure entanglement can be extracted from it. Clearly, 
it holds that E^ > Ejj, as one cannot extract from a state more entanglement than needed for its 
preparation. Interestingly, there are states that display an intriguing form of irreversibility: despite 



having a positive entanglement cost {Ec > 0) , they are non-distillable {Ed = 0) . These states are called 
bound entangled |17j . Consequently, the whole set of entangled states is composed of distillable, or free 
entangled states, and bound entangled states. 

Detecting whether a given state is non-distillable is in principle a very hard question, as one has to 
prove that no LOCC protocol acting on an arbitrary number of copies of the state is able to extract any 
pure entanglement. However, a very useful result derived in 17J shows that a quantum state that remains 
Positive under Partial Transposition [TH] (PPT) is non-distillable. Whether Non-Positivity of the Partial 
Transposition, or Negative Partial Transposition (NPT), is sufficient for entanglement distillability is 
probably the main open question at the moment in Entanglement Theory. Evidence |19[ I20j has been 
given for the existence of NPT states that are bound entangled (see however [21] )■ Note that the existence 
of these states would imply that the set of non-distillable states is not convex and that entanglement of 
distillation is non-additive [?]■ A necessary and sufficient condition for the distillability of a quantum 
state is provided by the following 

Theorem 1. A state p acting on % — T-La ® T~Lb is distillable if and only if there exist a finite integer 
number n>\ and two dimensional projectors P : "H^" — > C^ and Q : 'H'g" — )■ C^ such that the state 

p' ^{P®Q)p'^^^{P®Q)^ (2) 

is entangled. 

Actually, since the resulting state acts on C^ C^, this is equivalent to demand that p' is NPT, as 
this condition is necessary and sufficient for entanglement in the two-qubit case [22l . Furthermore, it is 
worth mentioning here that, if such a projector exists for some number k of copies, the state is said to 
he k — distillable. 

1.2 Secret-key agreement scenario 

The main scope of this section is to introduce the secret-key agreement scenario. This scenario consists 
of two honest parties, again Alice and Bob, who have access to correlated information, described by 
two random variables X and Y . These variables are also correlated to a third random variable Z that 
belongs to an adversarial party, the eavesdropper Eve, denoted by E. All the correlations among the 
three parties are described by the probability distribution P{XYZ). The honest parties aim at mapping 
the initial correlations into a secret key by LOPC, which is the natural set of operations between the 
honest parties. 

Similar questions as above can be addressed in this completely classical scenario. The classical 
equivalent of a maximally entangled state is a secret bit. A and B share perfect secret bits whenever 
P[XYZ) is such that the eavesdropper is factored out, P{XY) x P{Z), and their variables can take 
two possible values, X,Y — 0,1, that are perfectly correlated and random, P{X = Y = 0) = P{X — 
y = 1) = 1/2. Similarly as above, given some initial correlations, the goal is to quantify its secrecy 
content. The classical analog of Ec is the information of formation, denoted by // |53]. It is said that the 
probability distribution P{XYZ) contains secret correlations (or secret bits) whenever If{P{XYZ)) > 0. 
For distillation, the natural classical analog is the secret-key rate [24], denoted by S{X : Y\\Z), which 
quantifies the number of secret bits that can be distilled from given correlations by LOPC. Due to the 
difhculty of computing the previous quantities, it is useful to establish bounds on them. The intrinsic 
information |24| . I{X] Y ^ Z), provides a lower bound to the information of formation |23j and an upper 
bound to the secret-key rate 24 : 

S{X;Y\\Z) < I{X;Y i Z) < If{X;Y\Z) (3) 

It is defined as the minimal mutual information between A and B conditioned on E over all possible 
maps Z ^f Z the eavesdropper can perform, that is. 



I{X; Y iZ):= min 



I{X-Y\Z) : P^y^ ^Y.P^yz ■ P-z\z 



(4) 



In Ref [5S] it was shown that it is sufficient to consider the output alphabet Z of the same size as the 
input alphabet Z . 



A main open question in this scenario is whether there exist non-distillable secret correlations with 
strictly positive information of formation. These correlations are named bound information, as they would 
constitute a classical cryptographic analog of bound entanglement 12J. Compared to the entanglement 
scenario, identifying a single example of non-distillable correlations is much harder, due to the lack 
of a simple mathematical criterion, as Partial Transposition, to detect it. In a multipartite scenario, 
say of three honest parties plus an eavesdropper, the possibility of splitting the honest parties into 
different bipartitions hugely simplifies the problem and, indeed, there are examples of correlations that 
require secret bits for the preparation and from which no secret bits can be extracted [9j. The problem 
remains open for two honest parties, although evidence has been provided for the existence of bound 
information |12) . 

When studying the distillation properties of some given correlations, one usually employs Advantage 
Distillation (AD) protocols. These protocols were first introduced by Maurer [55j to show how two honest 
parties may be able to extract a secret key even in cases in which Bob has less information than Eve 
about Alice's symbols. Crucial to achieve this task is feedback, that is, two way communication between 
the honest parties. The general structure of an AD protocol is as follows [37] (without loss of generality 
we assume that Alice's and Bob's variables have the same size d): Alice first generates randomly a value 
^. She chooses a vector of N symbols from her string of data, a = (oi, . . . , apj), and publicly announces 
their positions to Bob. Later she sends him the A^-dimensional vector a whose components a^ are such 
that flfe © flfc = C holds Vfc. Here, © is the sum modulo d. Bob sums a to his corresponding symbols. If 
he obtains always the same value Xj then he accepts (this means that with very high probability X — C) 
otherwise both discard the N symbols. Although its yield is very low with increasing N, AD protocols 
allow the honest parties to distill a key even in a priori disadvantageous situations in which Eve has 
more information than Bob on Alice's symbols. Such protocols are used in what follows to estimate the 
distillability properties of correlations. Obviously, the fact that we are unable to map some correlations 
into a secret key by AD protocols does not mean that these correlations are non-distillable. At best, it 
can be interpreted as some evidence of bound information. 

Finally, another concept used in the sequel is that of binaryzation, which can be understood as the 
classical analog of the quantum projection onto 2-qubit subspaces used in Theorem [l] As in the quantum 
case, Alice and Bob agree on two possible values, not necessarily the same, and discard all instances in 
which their random variables take different values. Then, they project their initial distribution onto a 
smaller (and usually simpler) two-bit distribution. 

1.3 From Quantum States to Classsical Probabilities 

It is clear from the previous discussion that the entanglement and secret-key agreement scenarios have a 
similar formulation. One can go further and establish connections between the entanglement of bipartite 
quantum states and the tripartite probability distributions that can be derived from them [12J. Not 
surprisingly, the transition from quantum states to classical probabilities is through measurements (on 
the quantum states). Note also that, while in the quantum case the state between Alice and Bob also 
specifies the correlations with the environment, possibly under control of the eavesdropper, in the classical 
cryptographic scenario it is essential to define the correlations with the eavesdropper for the problem to 
be meaningful. 

As mentioned, if Alice and Bob share a state pab, the natural way of including Eve is to assume that 
she owns a purification of it. In this way the global state of the three parties is a pure tripartite IiPabe) 
such that pab — tr^ (\iIjabe){'4'abe\) ■ After this purification, measurements by the three parties, Mx, 
My and Mz, respectively, map the state into a tripartite probability distribution; 

P{XYZ) = tr {Mx (E)My(E)Mz |V'abb)(^asb|) (5) 

It has been shown that (i) if the initial quantum state is separable, there exists a measurement by the 
eavesdropper such that the probability distribution ([5]) has zero intrinsic information for all measurements 
by Alice and Bob [HI [25] and also zero information of formation [5^] and (ii) if the initial state is 
entangled, there exist measurements by Alice and Bob such that the probability distributions (l5| has 
strictly positive intrinsic information for all measurements by Eve [^ . 

Concerning the cryptographic classical analog of bound entanglement, bound information was first 
conjectured in Ref. JjL,. There, local measurements were applied to known examples of bound entangled 



states. It was then shown that the resulting tripartite probability distributions have positive intrinsic 
information but no known protocol allows the honest parties to distill a secret key. Of course, this does 
not mean that the distribution is non-distillable. Note however that the existence, and activation, of 
bound information was proven in a multipartite scenario consisting of three honest parties, plus the 
eavesdropper, in Ref. [S] (see also [TO])- The examples of multipartite bound information given in these 
works were derived from existing multi-qubit bound entangled states. 

2 Is the secret-key rate a non-additive quantity? 

This section presents our main results. Exploiting the analogies between the entanglement and secret- 
key agreement scenarios, we study whether it is possible to derive a cryptographic classical analog of the 
activation of distillable entanglement between bipartite quantum states given in Ref. f8l . This result is 
reviewed in the following section. We then map the involved quantum states onto probability distributions 
and study their secrecy properties. After applying classical distillation protocols, we show how the honest 
parties are able to distill a secret key from each of the distributions for the same range of parameters as 
in the quantum regime {Eo > 0). Finally, we introduce a distillation protocol analogue to the one used 
for the quantum activation. We prove that this protocol activates probability distributions containing 
conjectured bound information, although we cannot completely recover the quantum region. 

2.1 Quantum Activation 

As mentioned, we start by presenting the example of activation of distillable entanglement given in 
Ref. [5]. After introducing the states involved in this example, we review their distillability properties 
and the quantum protocol that attains the activation. 

2.1.1 Quantum States 

States that are invariant under a group of symmetries play a relevant role in the study of entanglement. 
The two classes of symmetric states considered here are Werner states [5D] and the symmetric states of 
Ref. [311 [5] , named in what follows symmetric states for the sake of brevity. 

Werner States. Acting on an Hilbert space H — T-La®T~Lb with dimensions dim{HA) = dim{HB) = 
d, and commuting with all unitaries U ®U ^ Werner states can be expressed as: 

Pw{p)^P—A-: + 0--p)—7^ (6) 

tr{Ad) tr(Sd) 

where Ad — {^ — nrf)/2, Sd — {t + Ild)/2 are the projector operators onto the antisymmetric and 
symmetric subspaces, 11^ is the flip operator and tr{Ad) = d{d — l)/2, tr{Sd) — d{d + l)/2. It is 
known that states ^ are entangled and NPT iff p > ps = 1/2. Moreover they are distillable, actually 
1 — distillable, if p > pid = 3t/(1 + 3t), where t = tr{Ad)/tr{Sd)- The states are conjectured to be 
bound entangled for Ps < P < Pid- 

Symmetric States. Acting on an Hilbert space H = Hai <8) 'Ha2 <8) Hbi ^ T-Ib2, the symmetric 
states under consideration commute with all unitaries of the form W — {U (^ V)a (8) (C^ <8) V*)b (where 
V* is the complex conjugate of V). These states can be represented in a compact form as _32J : 



J2^^P^/trm 



where Pi = yl^'^^P|,'\ P2 = 5^'^^Pi'\ P3 = ^i'^<8(l - ^df\ Pa - 5^'^®(1 - Prf)''^ ^d and l-P^ 
represent the projector onto the maximally entangled state ji/'j') = l/v^X]i=i !**)> ^^'^ ^*^ orthogonal 
complement, respectively. In Ref. |5] the authors identify a region in the space of parameters A^ so that 
the state a (i) is bound entangled but (ii) gives a distillable state when combined with a Werner state 
in the conjectured region of bound entanglement. Among all the states with these properties, we focus 
here on: 

tr{Ad) tr{Sd) tr{t - Pd) 



where q = l/{d+2). This state is a universal activator, in the sense that it defines a distillable state when 
combined with any entangled Werner state. It is also relevant for what follows to study the distillability 
properties of states ^ for any value of q and d — 3. These states are NPT and 1-distillable for q > 1/5. 
The latter follows from the fact that in this region, there exist local projections on two-qubit subspaces 
mapping states (l7| onto an entangled two-qubit state. The qubit subspaces are spanned by |00), |01) 
on Alice's side and |10), |11) on Bob's. Figure [1] summarizes the main entanglement properties of these 
states. 
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Figure 1: Entanglement properties of Werner, pvfi ^nd symmetric state, <T{q), for the qutrit case (d = 3). In the region 
between separabihty and 1-distiUability, pw is NPPT and conjectured bound. The point q = 0.2 represents the extremal 
value for which states cr{q) are PPT, thus not distillable. For larger values of q the states are distillable (in particular, 
1-distillable). 



2.1.2 Protocol for Quantum Activation 

As already announced, any entangled Werner state, and in particular any conjectured bound entangled 
Werner state, gives a distillable state when combined with the universal activator a{q) with q — l/{d+2), 
simply denoted as a. If initially the two parties are sharing a Werner state p acting on Hq = "Haq ® ^So 
and a symmetric state a acting on 7^1,2 = 'Hai ® 'Ha2 ® Hbi ^ "Hsai each party applies a projection 
onto a maximally entangled states on Hao ® T~Lai a-nd T-Lbq ® T~Lbi respectively. The resulting state is an 
isotropic state pi^o acting on 'Ha2 ® ^S2 • Recall that isotropic state are U ®U* invariant and defined 
by the convex combination of a maximally entangled state and white noise, I/d^. One can see that the 
resulting isotropic state has an overlap with a maximally entangled state, iT:{piso^ d) i larger than 1/d for 
any entangled Werner state. As shown in 33 , this condition is sufficient for distillability. 

2.2 Classical Activation 

This section contains the main results of our work. Our goal is to construct a classical cryptographic 
analog of the quantum activation example discussed above. 

We first associate probability distributions to all the previous quantum states. In order to do so, we 
purify the initial bipartite noisy quantum states pab by including an environment, and then map the 
tripartite quantum states \iPabe) onto probability distributions by performing some local measurements, 
see (l5|. The procedure to choose these measurements is always the same: computational bases for the 
honest parties, and general measurements for Eve. More precisely, denoting by X and Y the result 
obtained by Alice and Bob, this effectively projects Eve's system onto the pure state \exY) = {XY\'ij)ABE) 
with probability P{XY) = {XY\pab\XY) . Given that, the measurement that Eve applies is the one 
that minimizes her error probability when distinguishing the states in the ensemble {\exY),P{XY)}. 
Note that this choice of measurement may not necessarily be optimal from Eve's point of view in terms 
of the secret correlations between Alice and Bob, but it seems a natural choice. This procedure is applied 
to the two family of states, namely Werner and symmetric. Because of the symmetries of these states, 
the measurements minimizing Eve's error probability can be analytically determined using the results of 
Refs ElESI. 



In order to characterize the secrecy properties of the obtained probabihty distributions, we compute 
the intrinsic information when numerically possible and use AD protocols for distillability. We stress 
that the considered protocols distill a secret key in the same region of parameters in which entanglement 
distillation was possible for the initial quantum states. Finally, we introduce a quantum-like activation 
protocol that maps the two probability distributions into a new distribution in which Alice and Bob 
each have a bit. We then prove that an AD protocol allows distilling a secret key for some value of the 
parameters in which the initial quantum states were non-distillable. However, we are unable to close all 
the gap between entanglement and 1-distillability for the Werner state. 

2.2.1 Probability Distributions 

Werner states distribution. We start by mapping the Werner states of two qutrits onto a probability 
distribution Pxyz following the recipe explained in the previous section. In this way, we get a one- 
parameter family of probability distributions Pxyz, (see Table [I] for details), which depends just on the 
same parameter p defining the initial Werner state m . The resulting distributions are given in Table flj 
The indices for Eve's symbols specify her guess on Alice's and Bob's symbols or, in other words, if Eve 
outcome is Z = Zij, the most probable outcomes for Alice and Bob are X = i and Y = j. 
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Table 1: Tripartite probability distributions derived from Werner states (Iml. The parameters in the table are as follows: 
Ai = (1 — p)/6, A2 = p/3 and 5z = (v'AT— v/A2)'^/(2(Ai -I- A2)). Rows (columns) represent Alice's (Bob's) symbols. Eve's 
symbols are shown in parenthesis. For example, the cell {X = 0,Y = 1) shows that whenever Alice and Bob get (0,1) 
(which happen with probability (Ai + A2)/2), Eve correctly guesses the symbol zqi with probability 1 — 5z, and makes an 
error (symbol 210) with probability 5z- 



As done for entanglement, we now characterize these distributions in terms of their secret correlations. 
Recall that for the quantum case and qutrits, the state was entangled for p > ps — 1/2 and conjectured 
non-distillable for p < pi^ — 3/5. As we show next, the same values appear for the analogous classical 
distributions. Concerning the point Ps, we compute the intrinsic information of the distributions in 
Table [l] by numerical optimization over all possible channels by Eve. Of course, one can never exclude 
the existence of local minima and, therefore, that the intrinsic information is strictly smaller than what 
numerically obtained. One may wonder why this computation is necessary. For instance, at the point 
P — Ps the quantum state is separable and, then, it is known that there exists a measurement by Eve 
such that the intrinsic information between Alice and Bob is zero for all measurements. Note however 
that in terms of intrinsic information, the optimal measurement by Eve is the one that prepares on Alice 
and Bob the ensemble of product states compatible with the separable state Alice and Bob share. This 
measurement is not necessarily the same as the one minimizing Eve's error probability when Alice and 
Bob measure in the computational bases. The same applies to the entanglement region. While there 
are measurements such that Alice and Bob share secret correlations no matter which measurement Eve 
performs, these measurements are not on the computational bases. 

Using the numerical insight, we find a conjectured optimal channel that reproduces the numerical 
results. The optimal channel gives zero intrinsic information exactly at the point p — Ps- It maps Eve's 
symbols za onto zij with i y^ j with equal probability (i, j — 0, 1, 2). Its easy form leads to the following 



analytical expression for I{X;Y l Z): 



I{X; YiZ) = - log(l - x^) - a; log i^^^^—^ ) + ^ l^S (^' - 4-^') + {^-\) ^^S^^ - r) 
where t = 1 + p^ x — ^2p{\ — p). Figure 2 shows the behavior of this quantity in the region of interest. 
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Figure 2: Behaviour of the intrinsic information for the PxYZ relative to the Werner state. Note that: i) I(X\ Y \, Z) 
is equal to at point p = 0.5 which corresponds to the last point of separability for the Werner state; ii) 1(X\ Y 4, Z) is 
strictly positive at point p = 0.6 which corresponds to the extreme value of p for which it is 1-copy distillable. 



Moving to the distillability properties, we study AD protocols and identify a value of p for which 
positive secret-key rate can be obtained by the two honest parties through these protocols. The considered 
protocol is the quantum analogue of the quantum one and uses a binaryzation. Alice and Bob first discard 
one (but the same) of their symbols. Then, one of the parties, say Bob, applies a local permutation to 
his symbols. For example, if they agreed on discarding symbol 2, then Bob applies O 1. Alice and 
Bob now apply AD to the resulting two-bit distribution. This distribution is shown in Table [2] 

From the obtained table, it is possible to estimate the dependence of Bob's and Eve's errors on the 
size of the blocks used for AD, denoted by N . Recall that in the case of bits the protocols works as 
follows: Alice generates a random bit ^ and chooses N symbols a from her list of data. She then sends 
to Bob the information about these symbols and the vector a such that ai®ai = C,i'^i- Bob takes the 
symbols in his list corresponding to those chosen by Alice, b, and accepts only when x = ^i © fli,Vi. 
Bob's error probability /3jv is now easy to compute. Denote by /3 the error probability in the initial 
two-bit probability distribution, /? = P{X ^Y) = 2Ai/(3Ai -H A2). Bob accepts a bit whenever either all 
his N symbols are identical to those of Alice, which happens with probability (1 — /3)^, or all his symbols 
are different, whose probability is /3^. Thus, the probability of accepting a wrong bit conditioned on 
acceptance is given by: 

The upper bound becomes tight in the limit N ~> 00. 

We now move to the estimation of Eve's error cat. As her information is probabilistic, there is always 
a non-zero probability that she makes a mistake. For the estimation we compute a lower bound on the 
error given by all the cases in which the A^ symbols observed by Eve do not provide her any information 
about the value of the bit generated by Alice. In the computation, it is simpler to use Eve's probabilities 
conditioned on the fact that Alice and Bob have made no mistake after AD (which means that no mistake 
has occurred for any of the N symbols). Or in other words, we only consider the terms in the diagonal 



^"^ " /3^ + (1 - /3)^ ^ 








1 





Ai+A2 \^Z {Zll) 

' \l-5z (zoo) 


Ai (zoi) 


1 


Ai (zio) 


A1+A2 Uz (zoo) 
' \l-Sz (zii) 



Table 2: Two-bit distribution resulting from projecting the initial distribution of Table 111 on the space X,Y = 0,1 and 
after Bob permutes his symbol. For the sake of clarity, we apply a permutation also on the second index of Eve's symbols, 



that is Zi 



All the terms in the table should be normalized by a factor 3Ai + A2. 



of Table [2] This does not make any difference for what follows as in the limit N ^ 00 the probability of 
Bob accepting a wrong symbol goes to zero. After Bob's acceptance, Eve knows that the actual string a 
used by Alice is either equal to a (the one sent on the public channel) when C = 0, or a' (the permuted 
one, that is, a'^ — 1 — a^) when C = 1- Clearly, all the events in which the TV symbols observed by Eve, 
Z(*), are such that P{Z^^\. Z'^'ja = a) = P{Z^'^\. Z(^)|a = a') do not give her any information about 
Q. In these cases. Eve has to randomly guess Alice's symbol and makes an error with probability 1/2. 
Due to the symmetry in the diagonal of Table l2J that is, P{Z = zool-'f = 0) = P{Z — zn = 1\X — 1) 
and P{Z = zii\X = 0) = P{Z = zoo\X = 1), all the events where Eve has exactly N/2 of her symbols 
equal to zqo a-nd A^/2 equal to zn satisfy the previous condition and, thus, contribute to her error. 
Counting all the possible ways of distributing these cases leads to the following lower bound on Eve's 
error probability [55] : 

1 f N 



e-N ^ 



N/2 



y^'j^i-szr'^ 



(9) 



where 5z is the probability for Eve to guess wrongly conditioned on those cases in which Alice and Bob's 
symbols coincide (this value is made explicit in the caption of Figure [l]) . The asymptotic behavior of 
M, after applying the Stirling's approximation (71!)^ ~ (2n)!/2^" and expanding the binomial coefhcient 
can be expressed as: 

ejv > c{2^5z{l 



Sz)) 



N 



with c being a positive constant. 

By comparing Eqs. (Isl) and ( 10 1 one concludes that whenever 



/3 



I-P 



<2^5z{l~5z) 



(10) 



(11) 



key distillation is possible. This follows from the fact that, if this condition holds, Bob's error is ex- 
ponentially smaller than Eve's with N . This in turn implies that it is possible to choose a value of N 
such that Alice-Bob mutual information is larger than Alice-Eve and one-way distillation techniques can 



distill a secret key. From (10) one gets that AD works whenever p > 3/5, as for 1-distillability in the 



quantum case. Before concluding this part, we would like to mention that the same range of parameters 
for distillation is obtained if one applies the generalized AD protocol of Ref . [27: . 



Symmetric states distribution. We apply the same machinery to the symmetric states cr{q). 
Again, the symmetries of the states allow the explicit computation of the measurement by Eve minimizing 
her error probability for any value of q. The obtained distributions, denoted by Qxi yi X2 Y2 Z' i^ 
significantly more complex and shown in Appendix A. It consists of two trits for Alice, (A"i, X2) and two 
trits for Bob, {X2, I2), while Eve's variable can take 63 possible values. It is now much harder to estimate 
the secrecy properties of the distribution. For instance, we did not make any attempt to compute the 
intrinsic information. However, we are able to show that Alice and Bob can distill a secret key whenever 
q > 1/5 as in the quantum regime. 



To simplify our task, we exploit again the concept of binaryzation. Inspired by the quantum projec- 
tions used for the distillation of a{q), Alice and Bob select two outcomes on each side, namely 00, 01 for 
Alice and 10, 11 for Bob. The obtained two-bit distribution is shown in Table [3] 







0[10] 






1[11] 








>G 


(^oioo) 










Pl 


(^Olll) 






0[00] 


1+7, , 
5+11? 


Pl 
Pb 
Ph 
Ph 


(^0122) 
(^1000) 

(^lOll) 

(Z1022) 


3(1-9) fl/2 
2(5+llg) \ ^.^ 


(^0101) 
(21001) 












'Pl 


(^0100) 












Pg 


(^Olll) 


1[01] 


3(1-9) 
2(5+11?) 


(1/2 
1 1/2 


(^0110) 
(^1010) 


1+79 , 
5+11? 


Pl 
Ph 
Pb 
Ph 


(^0122) 
(^1000) 
(^1011) 
(^1022) 
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Note that we have 



Table 3: Two-bit distribution obtained as a result of the binaryzation applied to Q 
relabeled the old symbols (shown in square brakets) by and 1, in the following we use X ,Y to refer to them. The parameters 
in the table are as follows: o = ^JSq/(l + 7(j) and 7 = ^(1 - (?)/(2(l + 7q)), Pq = (a + 27)2/6, Pb = (-0 + 27)^/6, 
PL = (a- 7) V6, Ph = (a + 7)^6- 



They apply the standard bit AD protocol to this distribution. As before, Bob's error can be easily 
computed, getting the same as in Eq. (l8|, but now with /3 equal to 3(1 — q)/{5 + llq). The estimation of 
Eve's error is much more cumbersome. As above, the main idea is to derive a lower bound on it based 
on those instances in which Eve's symbols do not provide her any information about the symbol C Alice 
used for AD. Again, one can restrict the analysis to the terms in the diagonal of Table |3] The main 
difference in comparison with the simple case discussed above is the larger number of symbols for Eve. 
However, given the symmetry of the distribution [3] it is enough to consider Eve's symbols pair- wise: 



P(Z = 



: ^oiool^^ - 00) = PiZ = SouilXY = 11) = ^1 
P{Z = ioiool^^ = 11) = P{Z = Soin\XY = 00) = m 
P{Z = zioool^^ = 00) = P{Z = iioiillf - 11) = h 
P{Z = iioool^^ = 11) = P{Z = zioiillf = 00) - 772 



where we have used X^Y to denote the re-labeling of Alice and Bob's symbols. Note that the last 
two subindexes of Eve's symbols are those that give her information about Alice's (and Bob's) symbol. 
Symbols z**22 give her no information about Alice's symbols, so we sum them, their total probability 
being (S3. Given the public string a^r, one can see that all those cases for which Eve has the same number 
ni of zoioo and zom and the same number 712 of 5iooo and zioii, with A'' = 2ni -|- 2n2 -|- 2^3 and where 
2n3 is the total number of symbols 2**22, contribute to her error. Thus, counting all these cases leads to 
the following lower bound on Eve's error: 



1 ^ N\ 

'"^2^±„3(2-i)!(2"2)!(2n3)! 



2yM^)'"'(2y^)'"'(<53)'"^ 



(12) 
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where Si and rji are the probabihties shown above but normahzed (since as aheady stated we are consid- 
ering the asymptotic case). After Stirhng's approximation and summing eq. (12) the following compact 
form is obtained: 

with c being a positive constant. Comparing the scaling of the errors, one has that AD works whenever 

-^ < 2 V^ + 2^^ + b-i 



P 



(13) 



where the right hand side is equal to (a + 7)^/3 (the values of a and 7 are reported in the caption of 
Table [31). Eq. (13) is hence satisfied whenever q > q ~ 0.2, as announced. 



2.2.2 Protocol for Classsical Activation 

Inspired by the quantum activation example of Ref. [S], we consider the following classical protocol. 
Alice and Bob have access to the trits X and Y, whose correlations are described by Pxyz, and the two 
trits (Xi, ^2) and (^1,^2) correlated according to Qjci yi X2 Y2 z- Alice (Bob) keeps X2 {Y2), and only 
X2 {Y2), whenever X — Xi {Y — Yi); otherwise they discard all the symbols. This filtering projects 
the initial probability into a slightly simpler two-trit distribution. The new probability distribution 
Q*(X2,y2,^) reads: 



Q*{X2,Y2,E)^ J2 PiX^x,Y^y,Z)Q{Xi^x,Yi^y,X2,Y2,Z) 



(14) 



a:,y— 



where E = [Z, Z] is the collection of Eve's ymbols. Finally Alice and Bob binaryze their symbols by 
discarding one of the three values (the same for both), say 2. The resulting distribution is shown in 
Table H 

As above, we use AD protocols to estimate the value of p for which Alice and Bob can extract a 
positive secret key rate if they arc sharing pairs of bits distributed according to Table |4] We are able to 
prove that whenever p > p^ — 0.513 an AD protocol allows distilling a secret key from the distribution in 
Table|4]and, thus, a form of activation is possible. Unfortunately, we are unable to reach the point p — 0.5, 
as in the quantum scenario. However, our analysis suggests that the secret key rate is non-additive for 
some values of p. In the following we summarize the key steps leading to this result. 



SuccessMCAD | | 
NotActivReg. | | 




Figure 3: The CAD protocol certifies that if the Werner state distribution (Table 111) is taken with p > 0.513 positive 
secrecy can be extracted by the honest parties. Unfortunately, we cannot completely close the gap up to p = 0.5. This 
would have shown a direct correspondence between the quantum and the classical scenario. 
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Table 4: Resulting tripartite distribution after the application of the classical protocol by the two honest parties. The 
initial probability distributions PxYZ E'nd Qxi Yi X2 Y2 z ^''-'^ mapped to the new probability distribution Q*{X2, Y2, E) 
shown above. Prom this classical object we can derive the minimum value of p for which positive secret key can be extracted 
by A and B. The parameters that appear above are expressed as a function of p and q, the two key parameters in the 
initial probability distributions, cat = (Ai + A2)(5 + llg)/48 + 5Ai(l - g)/24, sjv = (1 + 7(j)/(144c]v), i,s,t = 0,1,2 with 
s y^ t and s < t. In our procedure the optimal q for the symmetric state distribution is taken equal to 1/5. 
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As mentioned, the values of interest for Pxyz and Qxi yi X2 Y2 z ^^'^^ ^-^ < P ^ 0.6 and q = 0.2, 
respectively. The distribution Q*{X2,Y2,E) resulting from the local filtering by the honest parties 
depends on the parameter p. In order to estimate Eve's error we follow a similar argument as for 
Qxi Yi X2Y2 z^ ^°^ adapted to this slightly more complex case. Despite the big amount of symbols on 
Eve's side (see Table [4]), the symmetry in the distribution leads to six main classes that are relevant for 
the AD analysis (appendix B further clarifies this point). These arguments lead to the following bound 
on Eve's error: 

1 ^-^ TV! / / \ 2"l / , \ 2n5 



y(6y^r^) '...(e^J^) '<5f« (15) 



2 ^ (2m)!... (2716) 

rii,n2...ne 

where X]i=i 2?^i = N . Note that as before the terms Sit'ji with i = 1 ... 5 take into account those cases 
in which Eve has Ui symbols that coincide with the public string sent by Alice and n^ symbols that 
are opposite to those appearing in the public string. The last term, 8^, as before, refers to the sum of 
probabilities for which Eve has no information at all (see details in appendix B). In the asymptotic case 



we are treating here, Eq. ( 15 ) converges to a multinomial distribution, namely: 

N 



EAT > c f 6 [ySim + • ■ ■ V^b^bj + 5q\ (16) 



with c being a positive constant. Bob's error is much easier to compute, getting /3 = (3Ai + A2)(l 
(j)/(16cAr). Putting these two terms together, we have that the AD protocols works whenever: 



1-/3 



<6 



(y^W +---y¥^) +^6 (17) 



Figure l3] shows the ratio between the left hand side and the right hand side, i?^e, as a function of the 
parameter p. As above, whenever Rp^ < 1, the AD protocol succeeds. The point at which i?^^ — 1 
corresponds to p — 0.513, as already announced. 

3 Conclusions 

Non-additivity is an ubiquitous phenomenon in Quantum Information Theory due to the presence of 
entanglement. In this work, we provide some evidence for the existence of similar effects for secret classical 
correlations. Exploiting the analogies between the entanglement and secret-key agreement scenario, we 
have shown that two classical distributions from which no secrecy can be extracted by AD protocols can 
lead to a positive secret key rate when combined. 

The evidence we provide is somehow similar to the conjectured example of activation for bipartite 
entangled states. Note however that, in the quantum case, one of the two states is provably bound. 
As mentioned several times, it could well happen that one, or even the two probability distributions 
considered here are key-distillable. Indeed, there exist examples of bound entangled states from which 
one can obtain probability distributions with positive secret-key rate 137]. Note however that all the 
known examples of bound entangled states with non-zero privacy are based on the existence of ancillary 
systems on the honest parties, known as shields, that prevent Eve from having the purification of the 
systems Alice and Bob measure to construct the key. If any of the probability distributions constructed 
here were key distillable, they would constitute a novel example of secret correlations from a bound 
entangled state that does not fit in the construction of 37J. 
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Appendix A 

This appendix shows the probabihty distribution obtained by AUce, Bob and Eve after measuring the 
symmetric state nh . Being the table very big we try to give here a schematic representation of it which 
can be equivalently useful to the reader to follow our arguments. It reads: 
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Table 5: Schematic view of the distribution Qxi yi X2 Y2 Z' Due to the lack of space, cells have been grouped in terms 
of probability distributions and number of elements (symbols) as explained below. 

The joint probabilities P{Xi = i,Yi = k, X2 = j, I2 = between the honest parties are distributed as 
follows: 

- cells of type (1^), with i — u,v,w are equal to -^ 

- cells of type (2^), with i = u,v,w, are equal to -j^; 

- cells of type * , are equal to ^^ ; 

- cells of type + , are equal to -g^ ; 

Concerning Eve's side (see caption of Table fll for more details about how to read the tables): 

- cells of type (1;), with i = u,v,w contain three elements. The terms that play a role in her 
discrimination are indicated by the same number and subindex letter. For example, consider the 
cell Xi = 0, Yi = 0, X2 = 0, F2 = 0. The label 1^ is used for this cell (the same one indicates 
Xi=0,Yi=0,X2 = l,Y2 = l and Xi = 0, Fi = 0, X2 = 2, Fa = 2). The three elements here are 
the three probability distributions: 

P(0,0,0,0,zoo,oo), P(0,0,0,0,zoo,ii), P(0, 0,0, 0,200.22). 

P(0, 0, 0, 0, ^00, 00) refers to the probability that Eve guesses correctly, the remaining two F(0, 0, 0, 0, ^00,11 )j 
P(0, 0,0, 0,^00,22) refers to the probability she guesses wrongly. 

- cells of type (2^), with i ~ u,v,w, contain six elements; 

- cells of type * , contain two elements distributed with probability one half (in this cases, she knows 
nothing about A and B symbols) ; 

- cells of type + , contains only one term since in this case Eve's symbol is perfectly correlated with 
those of A and B; 
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Appendix B 

In this second appendix, we clarify why it is enough to consider six classes of distributions in the AD 
analysis of section |2.2.2[ From Table |4] the following relations hold: 

PiE = [zu,Sum]\X2Y2 = 00) = P{E = [zu,Suii]\X2Y2 = 11) = Si 
P{E = [zu,Suii]\X2Y2 = 00) = P{E = [zu,Suoo]\X2Y2 = 11) = fji 
P{E = [ztsrzstm]\X2Y2 = 00) = P{E = [zts,Sstii]\X2Y2 = 11) - h 
P{E = [ztsrzstii]\X2Y2 = 00) = P{E = [ztsrzstm]\X2Y2 = 11) = m 
P{E = [zt,rztsm]\X2Y2 = 00) = P{E = [zts,Stsii]\X2Y2 = 11) = ^3 
PiE = [zts,Stsii]\X2Y2 = 00) = P{E = [zts,StsOo]\X2Y2 = 11) = m 
P{E = [zst,SsWo]\X2Y2 = 00) = P{E = [zsuSstii]\X2Y2 = 11) = ^4 
P{E = [zst,Sstii]\X2Y2 = 00) = P{E = [zst,SstQo]\X2Y2 = 11) = m 
P{E = [zsu~ztsOo\\X2Y2 = 00) = P{E = [zst,Stsii]\X2Y2 = 11) = 65 
P{E = [z,uZtsii]\X2Y2 = 00) = P{E = [zsuStsOo]\X2Y2 = 11) = 775 

and ^6 is the sum of all the P{E — [z**, z**22]|A2 — Y2). As already stated in the caption of Table [ij 
i,s,t — 0,1,2 with s ^ t and s < t. In the computation, it is simpler to use Eve's probabilities 
conditioned on the fact that Alice and Bob have made no mistake after AD, so this means that we only 
need to consider the terms in the diagonal of Table [4] For this reason the 5i, rji appearing in eq. ( 15 ) are 



the previous ones but normalized. The complete expression is then derived according to the argument 
already presented at page [T0| 
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